Merge ~athos-ribeiro/ubuntu/+source/phpmyadmin:wdes-sru-set-jammy into ubuntu/+source/phpmyadmin:ubuntu/jammy-devel

[Athos Ribeiro]

Hi William,

This is the jammy SRU MP for LP: #2016015, #2016016, #2016018.

I removed the fix for LP: #2016017 from this MP. Please, refer to that bug for further context.

I pushed the package to a PPA at: https://launchpad.net/~athos-ribeiro/+archive/ubuntu/phpmyadmin-srus/+packages

[William Desportes (williamdes)]

The diff is 99% the same as the one I had built, so it's okay.

That said while comparing I had some files that where different (non related to the patch):
git diff williamdes_launchpad/ubuntu/jammy-stable..athos-ribeiro/wdes-sru-set-jammy

So I am wondering if your base branch or my base branch where wrong.
Anyway, the debdiff is okay and can be merged on top of the actual version: 4:5.1.1+dfsg1-5ubuntu1

review: Approve (debdiff)

[Athos Ribeiro (athos-ribeiro)]

Thanks, William.

It seems your branch is based on pkg/applied/ubuntu/jammy-devel while mine is based on pkg/ubuntu/jammy-devel. The former is a branch with the patches from debian/patches already applied. When proposing MPs for jammy, you want to use the latter as a base.

[Athos Ribeiro (athos-ribeiro)]

Adding the server team as a reviewer for visibility.

[Athos Ribeiro (athos-ribeiro)]

Uploaded

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading phpmyadmin_5.1.1+dfsg1-5ubuntu1.1.dsc: done.
  Uploading phpmyadmin_5.1.1+dfsg1-5ubuntu1.1.debian.tar.xz: done.
  Uploading phpmyadmin_5.1.1+dfsg1-5ubuntu1.1_source.buildinfo: done.
  Uploading phpmyadmin_5.1.1+dfsg1-5ubuntu1.1_source.changes: done.
Successfully uploaded packages.

[Athos Ribeiro (athos-ribeiro)]

I am re-submitting this after removing the fix for LP: #2016017 from this MP. Please, refer to that bug for further context.

[William Desportes (williamdes)]

review: Approve

[Athos Ribeiro (athos-ribeiro)]

Uploaded.

diff --git a/debian/NEWS b/debian/NEWS
index 3f51719..2e1490a 100644
--- a/debian/NEWS
+++ b/debian/NEWS
@@ -1,3 +1,14 @@
+phpmyadmin (4:5.1.1+dfsg1-5ubuntu1.1) jammy; urgency=medium
+
+  Due to the delta carried in the Ubuntu PSR stack, phpmyadmin does not run
+  with PHP versions < 8. We now make it fail gracefully by explicitly
+  requiring PHP >= 8 instead of allowing phpmyadmin to abruptly crash. In that
+  case (the user tries to run phpmyadmin with PHP < 8), we now provide useful
+  error messages so users understand what their next steps should be towards
+  getting a functional phpmyadmin deployment.
+
+ -- Athos Ribeiro <[e-mail]>  Fri, 12 May 2023 18:05:28 -0300
+
 phpmyadmin (4:4.9.1+dfsg1-1) unstable; urgency=low
 
   phpMyAdmin webbased setup is not included anymore.
diff --git a/debian/changelog b/debian/changelog
index 392befb..d759a5f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,17 @@
+phpmyadmin (4:5.1.1+dfsg1-5ubuntu1.1) jammy; urgency=medium
+
+  [ William Desportes ]
+  * Require PHP >= 8.0 (LP: #2016016)
+  * Add PHP 8 support on apache2 conf (LP: #2016015)
+  * Fix XSS vulnerability in drag-and-drop upload (LP: #2016018)
+    - CVE-2023-25727
+    - PMASA-2023-1
+
+  [ Athos Ribeiro ]
+  * d/NEWS: document new behavior when running PHP < 8
+
+ -- William Desportes <[e-mail]>  Fri, 14 Apr 2023 18:11:15 +0200
+
 phpmyadmin (4:5.1.1+dfsg1-5ubuntu1) jammy; urgency=medium
 
   * Add patch to drop testImportOsm and
diff --git a/debian/conf/apache.conf b/debian/conf/apache.conf
index 9d40aa2..cd8a401 100644
--- a/debian/conf/apache.conf
+++ b/debian/conf/apache.conf
@@ -12,6 +12,12 @@ Alias /phpmyadmin /usr/share/phpmyadmin
         php_admin_value open_basedir /usr/share/phpmyadmin/:/usr/share/doc/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/:/usr/share/javascript/
     </IfModule>
 
+    # PHP 8+
+    <IfModule mod_php.c>
+        php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
+        php_admin_value open_basedir /usr/share/phpmyadmin/:/usr/share/doc/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/:/usr/share/javascript/
+    </IfModule>
+
 </Directory>
 
 # Disallow web access to directories that don't need it
diff --git a/debian/control b/debian/control
index 2c74be6..6c016e4 100644
--- a/debian/control
+++ b/debian/control
@@ -1,5 +1,6 @@
 Source: phpmyadmin
-Maintainer: phpMyAdmin Packaging Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: phpMyAdmin Packaging Team <[e-mail]>
 Uploaders: Felipe Sateler <[e-mail]>,
            Matthias Blümel <[e-mail]>,
            William Desportes <[e-mail]>
diff --git a/debian/patches/CVE-2023-25727.patch b/debian/patches/CVE-2023-25727.patch
new file mode 100644
index 0000000..2482289
--- /dev/null
+++ b/debian/patches/CVE-2023-25727.patch
@@ -0,0 +1,24 @@
+From: William Desportes <[e-mail]>
+Date: Thu, 30 Mar 2023 22:55:06 +0200
+Subject: CVE-2023-25727 - XSS vulnerability in drag-and-drop upload
+
+Ref: https://www.phpmyadmin.net/security/PMASA-2023-1/
+
+Origin: upstream, https://github.com/phpmyadmin/phpmyadmin/commit/efa2406695551667f726497750d3db91fb6f662e
+---
+ js/src/drag_drop_import.js | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/js/src/drag_drop_import.js b/js/src/drag_drop_import.js
+index 55250c2..9b8710e 100644
+--- a/js/src/drag_drop_import.js
++++ b/js/src/drag_drop_import.js
+@@ -130,7 +130,7 @@ var DragDropImport = {
+                                 var filename = $this.parent('span').attr('data-filename');
+                                 $('body').append('<div class="pma_drop_result"><h2>' +
+                                 Messages.dropImportImportResultHeader + ' - ' +
+-                                filename + '<span class="close">x</span></h2>' + value.message + '</div>');
++                                Functions.escapeHtml(filename) + '<span class="close">x</span></h2>' + value.message + '</div>');
+                                 $('.pma_drop_result').draggable();  // to make this dialog draggable
+                             }
+                         });
diff --git a/debian/patches/Require-PHP-8.0.patch b/debian/patches/Require-PHP-8.0.patch
new file mode 100644
index 0000000..01dfe04
--- /dev/null
+++ b/debian/patches/Require-PHP-8.0.patch
@@ -0,0 +1,39 @@
+From: William Desportes <[e-mail]>
+Date: Fri, 14 Apr 2023 18:06:39 +0200
+Subject: Require PHP >= 8.0
+
+Due to the delta carried in the Ubuntu PSR stack, phpmyadmin does not run with
+PHP versions < 8. This patch makes it fail gracefully instead of allowing
+phpmyadmin to abruptly crash, allowing us to provide useful error messages so
+users understand what their next steps should be towards getting a functional
+phpmyadmin deployment.
+
+Bug: https://github.com/phpmyadmin/phpmyadmin/issues/17503
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/2016016
+Origin: vendor
+Forwarded: not-needed
+Reviewed-by: Athos Ribeiro <[e-mail]>
+---
+ libraries/common.inc.php | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/libraries/common.inc.php b/libraries/common.inc.php
+index 75f1274..074ad57 100644
+--- a/libraries/common.inc.php
++++ b/libraries/common.inc.php
+@@ -62,10 +62,12 @@ if (getcwd() == __DIR__) {
+  * Minimum PHP version; can't call Core::fatalError() which uses a
+  * PHP 5 function, so cannot easily localize this message.
+  */
+-if (PHP_VERSION_ID < 70103) {
++if (PHP_VERSION_ID < 80000) {
+     die(
+-        '<p>PHP 7.1.3+ is required.</p>'
+-        . '<p>Currently installed version is: ' . PHP_VERSION . '</p>'
++        '<p>PHP 8.0.0+ is required ('
++        . '<a href="https://bugs.launchpad.net/ubuntu/+source/symfony/+bug/1975892">Ubuntu Launchpad bug #1975892</a>'
++        . '&nbsp;and&nbsp;<a href="https://github.com/phpmyadmin/phpmyadmin/issues/17503">phpMyAdmin issue #17503</a>'
++        . ').</p><p>Currently installed version is: ' . PHP_VERSION . '</p>'
+     );
+ }
+
diff --git a/debian/patches/series b/debian/patches/series
index f474c59..ddd1fa2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,5 @@ allow-symfony-v5-for-PHP-8-compat.patch
 php-8.1-test-suite-fix.patch
 php-8.1-deprecation-fixes.patch
 drop-testimportosm-and-testdoimport-tests.patch
+Require-PHP-8.0.patch
+CVE-2023-25727.patch